[maintainer] refactor(metadata-protocol): split src/protocol.ts (33,065 lines, +10,169 in 30 days) along its ObjectStackProtocolImplementation seams, one move-only slice per PR

Filing gate ③: a task the maintainer dispatched, quoted verbatim below. Filed by domain:services seat 1 (seat post #6021) · os-sales · session session_016g7nYP9wdNx1GDa5XDr7Uy, as the domain:engine half of #24586's restart act. That half was handed over unfiled in 6341834009, and the engine surface is now this project's, folded into domain:server by PR #25247. ⛔ Not a claim.

The maintainer's words, verbatim (#24586, recorded in 6270097840): 「24586 同意A，是否建议这波分拆等 v18 发布之后再处理。」 Triage read the restart condition (npm @objectstack/spec latest ≥ 18.0.0) as true in 6291735609. The ruling's restart act: "one [maintainer] card per file over 10,000 lines into its owning lane … Each card starts with a fresh seam measurement taken at that time, in #23050's shape", and "protocol.ts goes first".

Reader who acts: the domain:server lane, engine surface (packages/metadata-protocol was domain:engine's). One dispatch per slice.

Measured (on `origin/main` `b2c0752900`, 2026-10-23)

Size and churn:
- 33,065 lines, up from 22,896 thirty days ago (dabf8d795e, the last commit before 2026-09-23T15:00Z): +10,169, +44.4%.
- 28 commits in 7 days and 184 in 30 days.
- git blame --since=2026-09-23T15:00Z attributes 13,445 lines (40.7%) to the last 30 days.
Structure:
- a 6,643-line module preamble: helpers, three error classes, and the query-param and filter vocabulary;
- one ObjectStackProtocolImplementation class, lines 6644–32941 (26,298 lines, 267 members);
- a 124-line trailer of package-persist helpers.
The sections, by contiguous member ranges:

section	lines	lines from the last 30 days
module preamble (helpers, error classes, query-param and filter vocabulary)	6,643	2,255
class head, flow/SDUI resolvers, registration hooks, authoring gates, mutation pub/sub, overlay index	1,961	707
discovery, types, diagnostics, packaged bases, credential carry-forward	1,578	339
metadata reads (`getMetaItems`, `readFlattenedMetaItems`, overlay rows, `readMetaItem`, layered, audit, `getUiView`)	2,872	1,696
query validation (`assertFieldsExist`, `refuseInternal`)	1,643	358
data CRUD (`findData` … `readAsCaller`)	1,393	274
`searchAll` + meta cache	605	160
batch and `*Many` data	1,067	33
write gates (overlay/code-only/organization/sealed/packaged-base, locks, version tokens, conflict audit)	2,619	1,772
registry hydration, view expansion, write-through, object storage	1,996	1,112
save refusals, `saveMetaItem` (1,535 lines alone), `saveConflict`, `migrateStoredMetadata`	2,960	1,666
history, publish, drafts, publish backfill (`publishPackageDrafts` 969 lines)	2,600	828
package revert/delete/duplicate/import, orphans, commits, `revertCommit`, rollback	2,837	1,335
diff, `deleteMetaItem`, `loadMetaFromDb`, load reports, `findReferencesToMeta`	1,831	624
install/update package + module trailer	460	286

Shared state a split must pass:
- The fields are engine (149 refs), getServicesRegistry (16), environmentId (11), the cluster pub/sub trio (clusterPubSub, clusterNodeId, clusterUnsubscribe), the two listener sets, authoringChannel, and about 20 warn-once and cache flags.
- Coupling is mostly method-to-method: 597 this.X( calls over 206 distinct members. Reads, write gates and saves call one another across the sections above.
What reads it by path:
- The ADR anchor file scripts/adr-anchors/packages__metadata-protocol__src__protocol.ts.json. It holds ADR-0005, 0029, 0087, 0119 and 0126, and its invariant names the two object-hydration seams applyObjectRegistryMutation and loadMetaFromDb. The metadata-plugin.zod.ts anchor file and scripts/symbol-anchors.mjs also name the file.
- 10 more files under scripts/: check-durability-degradation-log-level.mjs, check-engine-double-contract.mjs (+ .pinned.json, .seams.json), check-filter-alias-parity.mjs, check-nul-bytes.mjs, check-system-context-census.mjs, docs-audit/affected-docs.mjs, objectql-double-limit.baseline.json, query-options-erasure-baseline.json.
- 22 files under docs/ and content/, 11 of them ADRs.
- Tests: 180 test files in metadata-protocol import it, and 71 files in other packages name it by path.
In flight: none of the 21 open PRs touch the file.

The ask (from #24586's ruling and #23050's shape)

Split along the existing seams, one area per PR. Each slice is move-only: no logic changes.
Shared state stays explicit: moved code reaches the class's shared members through one named context object (the host pattern of [maintainer] refactor(rest): split packages/rest/src/rest-server.ts (13,701 lines, 70 commits in 30 days) along its register*Endpoints seams, one move-only slice per PR, /meta after #22877 stage 2 #23050, [maintainer] refactor(service-automation): split src/engine.ts (13,735 lines, +2,199 in 30 days) along its AutomationEngine seams, one move-only slice per PR #25222, [maintainer] refactor(plugin-security): split src/security-plugin.ts (10,746 lines, +2,803 in 30 days) along its SecurityPlugin seams, one move-only slice per PR #25223 and [maintainer] refactor(plugin-auth): split src/auth-manager.ts (10,338 lines, +1,867 in 30 days) along its AuthManager seams, one move-only slice per PR #25224). ⛔ Not a second copy of a helper, ⛔ not a re-derivation.
Every slice proves it moved nothing:
- every gate, baseline, ADR anchor and docs anchor that reads the file by path is migrated in the same PR and stays green;
- the ADR-0029 D9.8/D9.9 invariant's two seams keep a resolving anchor;
- the package's public .d.ts stays identical.
- ⛔ A gate whose target moved must not go silently empty.
Serial with the file's in-flight PRs: a slice waits for an open PR on the same region, or that PR merges main after the slice. At 28 commits a week, every slice measures the file's open PRs again at claim.
⛔ No new gate.

Not in this card

Any behaviour change.
A design change to the shared members beyond giving them an explicit context.
objectql/src/engine.ts (23,903 lines) and driver-sql/src/sql-driver.ts (22,096 lines). They are the other two engine-surface files under the same ruling, and they are filed once this card's first slices have landed ([Decision] Split the platform's largest, fastest-growing source files (protocol.ts 32,428 lines, +10,002 in 30 days) the way rest-server.ts was split, or leave them #24586's order: protocol.ts first).
spec/src/conversions/registry.ts, which belongs to domain:spec.

Dedupe

MCP search_issues on this repository, closed included, with two queries:

"split protocol.ts metadata-protocol move-only maintainer refactor"
"refactor split objectql engine.ts sql-driver.ts large file"

The hits were #24586 (the ruling this card carries out), #25222, #25223 and #25224 (the domain:services files), and #23050 (closed, rest-server.ts). None covers protocol.ts. New.

Generated by Claude Code

Claim: card thread · domain:server (former domain:engine surface) · for domain:services seat 1 (seat post #6021, project run by the Sales account; 由Sales账户的项目负责) · p2 · series card, cut 1 (one PR; cuts strictly serial) · 2026-10-23T15:20Z
Session: session_01J8pUyVs5eas1AjMdReJM7C
Account: os-sales (the seat's linked user; the card's assignee)
Branch: claude/project-thread-uasfag (the harness-pinned branch for this session, cut from origin/main ab510f4c43; it names no issue, so the Duplicate Fix Guard's branch-name hint will not match — this claim is the identity record)
Worktree: objectstack-wt (a linked worktree in this session's container)
Domain: domain:server
Seat: domain:services#1 (seat post #6021; the PR goes back to that seat for ACCEPT)
Ruling: #24586 letter A (6270097840), restart read in 6291735609. The series' .d.ts bar is ruling 6348891160 (sorted-union identity; raw identity reported when it holds).
Container & model: M, mode:thread, effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card (a [maintainer] refactor card).
Thread-read: none
Serial constraints cleared: none of the 21 open PRs touches packages/metadata-protocol/src/protocol.ts (each PR's file list read in this act against origin/main; #25451 touches only protocol.runtime-authoring-gate.test.ts, the Version Packages PR #24876 only CHANGELOG.md / package.json). No pm:dispatched card's claimed file surface names the file. Re-measured again before pr_create; a new open PR on the moved region means this cut yields.

File surface (read on origin/main ab510f4c43, where protocol.ts is 33,065 lines):

Cut 1 = the card's "batch and *Many data" section (the seat's suggested first slice: 1,067 lines, 33 of them from the last 30 days). Sixteen ObjectStackProtocolImplementation method bodies move unedited from packages/metadata-protocol/src/protocol.ts into a new module, packages/metadata-protocol/src/protocol-batch-data.ts, in the host shape of #23050 / #25222 / #25223 / #25224:

public: batchData :16696, createManyData :17263, insertManyData :17348, updateManyData :17390, deleteManyData :17574;
private: runAtomicBatchData :16739, runAtomicBatch :16775, runBatchDataLoop :16850, reconcileStoppedBatch :17108, locateBatchCause :17170, buildBatchDataResponse :17182, buildRolledBackBatchResponse :17219, runUpdateManyLoop :17424, buildUpdateManyResponse :17497, runDeleteManyLoop :17619, buildDeleteManyResponse :17708.
triggerAutomation :17527 sits between them but is not batch code; it stays.

How the host is built:

The class keeps every method, with its docblock, signature and position; each body becomes a literal of exactly the members it reads, plus a .call. async is dropped from the stubs, which return the moved function's promise.
Members read, measured by AST: engine (field), and the methods assertObjectRegistered, assertRecordExists, probeRecord plus the moved methods' calls to one another. Methods go as late-bound closures, so a spy or double set on the instance is still the one a body reaches. engine goes as a getter.
The only outside caller of a moved method is applyPublishBackfill (this.updateManyData(), which keeps calling the class method.

Module-level declarations the moved bodies read (all stay in protocol.ts; each has readers outside the moved text except mergeDroppedFieldEvents, which stays too, so no declaration moves):

export added in place, imported back by value or type from ./protocol.js: byIdUpdateRecord, mergeDroppedFieldEvents, rowOperationFailureFallback, rowRequiredIdError, toRowApiError, type BatchDataRowResult, type BatchDataLoopOutcome. src/index.ts exports from ./protocol.js by name, so none of them is published; the proof measures it (raw .d.ts and ESM/CJS export lists base vs head). Every value import is read only inside function bodies, so the module cycle is evaluation-safe; the PR lists each read site.
Imports the new module takes from packages directly (as protocol.ts does): engineCanRollBack, recordNotFoundError (@objectstack/core), omitInternalFieldsFromWriteResponse (./write-response-internal-fields.js), and the @objectstack/spec types the bodies name.

Path readers migrated in the same PR (each measured base vs head in the PR):

scripts/adr-anchors/: the protocol.ts entry's ADR-0119 paragraph describes batchData's atomic path, which moves. Per the series' rule, the new module gets its own entry carrying ADR-0119 and that paragraph verbatim; the protocol.ts entry is unchanged (ADR-0119 is still cited at five sites outside the moved text). check:adr-anchors decision-letter totals reported base and head.
protocol.bracketed-refusal-opener-absence.test.ts: the moved text holds 5 new Error( sites, so the new module joins its PRODUCERS list with a measured floor; otherwise those sites would leave the scan silently. protocol.ts keeps its floor of 5.
docs/adr/0119-…md anchors protocol.ts#batchData: the method shell stays, so it still resolves; check-adr-symbol-anchors run by hand at both ends.
Census and ledgers run base and head: tenant-audit census (the moved bodies hold engine insert/update/delete calls; if they shift class, --write plus the page's prose count, with a per-site base/head comparison), system-context census (0 isSystem reads in the moved text), query-options erasure ratchet (0 counted find/findOne/count/aggregate sites in the moved text), engine-double contract seams (deleteData / updateData rows, which stay), durability log level (scans the whole package).

⛔ Nothing else changes: no moved body is edited; the only stay-behind edits are the export keywords above and the stub bodies; no ADR or docs/adr/** text is edited; no new gate. One PR, skip-changeset (no behaviour change), Part of #25467.

Proof the PR carries: AST leaf-token identity of every moved body (with a one-token negative control), .d.ts block per ruling 6348891160 (raw and normalised sha256 base/head, normaliser, raw diff line count, positive control), ESM/CJS export lists, the metadata-protocol suite at base and head (same counts), dispatch-gates --commands all run with exits, and the hand gates above.

Landed cut 1 (batch and *Many data) · domain:services seat 1 (seat post #6021) · os-sales · session_016g7nYP9wdNx1GDa5XDr7Uy · 2026-10-23T17:23Z

reading	value
PR #25494	MERGED through the queue (the seat's ACCEPT is on the PR), head `b55faf2162`
`origin/main`	carries `bf5855b5bc`

State: the card stays open and dispatched (Part of). The card thread plans cut 2 on the merged protocol.ts and re-checks the in-flight PRs on the file first (serial rule). It claims cut 2 afresh before it pushes.

Generated by Claude Code

Claim: card thread · domain:server (former domain:engine surface) · for domain:services seat 1 (seat post #6021, project run by the Sales account; 由Sales账户的项目负责) · p2 · series card, cut 2 (one PR; cuts strictly serial; cut 1 landed as #25494, bf5855b5bc) · 2026-10-23T17:30Z
Session: session_01J8pUyVs5eas1AjMdReJM7C
Account: os-sales (the seat's linked user; the card's assignee)
Branch: claude/project-thread-uasfag (the harness-pinned branch for this session, restarted from origin/main 5188e7f18f after cut 1 merged; it names no issue, so this claim is the identity record)
Worktree: objectstack-wt (a linked worktree in this session's container)
Domain: domain:server
Seat: domain:services#1 (seat post #6021; scope agreed with the seat before this claim; the PR goes back to that seat for ACCEPT)
Ruling: #24586 letter A (6270097840), restart read in 6291735609. The series' .d.ts bar is ruling 6348891160 (sorted-union identity; raw identity reported when it holds).
Container & model: M, mode:thread, effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card (a [maintainer] refactor card).
Thread-read: none
Serial constraints cleared: none of the 12 open PRs touches packages/metadata-protocol/src/protocol.ts (each PR's file list read in this act, the Version Packages PR #24876 paged through all 395 files: only CHANGELOG.md / package.json in this package). Re-measured again before pr_create; a new open PR on the moved region means this cut yields.

File surface (read on origin/main 5188e7f18f, where protocol.ts is 32,468 lines):

Cut 2 = the discovery and diagnostics bodies from the card's "discovery, types, diagnostics, packaged bases, credential carry-forward" section: about 800 lines, 42 of them from the last 30 days (5%, the coldest slice left). Three ObjectStackProtocolImplementation method bodies move unedited into a new module, packages/metadata-protocol/src/protocol-discovery.ts (host DiscoveryHost), in the shape cut 1 used (#23050 shape B):

public: getDiscovery :8570, getMetaDiagnostics :9257;
private: listLiveMetadataTypes :9059.
Members read, measured by AST: engine (field, as a getter), and the methods getServicesRegistry, searchAll, getMetaItems, shippingPackagesOf, artifactLockLayerAt, servedLockState, isArtifactBacked (late-bound closures).

Stays, deliberately:

getMetaTypes :9077, between them: its body reads the private static ObjectStackProtocolImplementation.envWritableTypes(), which a module function cannot reach unedited (private statics stay, as in [maintainer] refactor(plugin-auth): split src/auth-manager.ts (10,338 lines, +1,867 in 30 days) along its AuthManager seams, one move-only slice per PR #25224). TYPE_TO_FORM, HAND_CRAFTED_SCHEMAS and toJsonSchemaSafe, read by it, stay with it. It keeps calling listLiveMetadataTypes through the class.
getProjectId :8566: its body is no longer than its stub would be.

Module-level declarations:

SERVICE_CONFIG :5498 is read only by getDiscovery: it moves with it, unedited with its docblocks, unexported.
type ShippingPackages :2304 is read by code that stays too: export added in place, imported back as a type. src/index.ts exports from ./protocol.js by name, so it is not published; the proof measures it.
The module imports from the same specifiers protocol.ts uses (@objectstack/spec/api, /system, /kernel, @objectstack/core, ./discovery-version.js, ./metadata-diagnostics.js, ./item-lock.js).

Readers (measured; the PR reports each base vs head):

scripts/adr-anchors/ protocol.ts entry: none of its paragraphs (ADR-0029 D9.8/D9.9 hydration seams, ADR-0119 batchData, ADR-0005/0087 view storage, ADR-0126 flow Regime C) describes these bodies, so no new entry. The decision letters inside the moved bodies leave the anchored surface; the exact check:adr-anchors count is reported base → head.
docs/qa/platform-checklist/areas/studio-authoring.json anchors protocol.ts#getMetaDiagnostics: the method shell stays, so it still resolves; not edited; check-platform-checklist at both ends.
None in the moved text: isSystem reads (system-context census), engine find/findOne/count/aggregate (erasure ratchet), engine update/delete seams (engine-double contract), new Error( (bracketed-refusal PRODUCERS), and none of the package's source-scanning pins' patterns.

⛔ Nothing else changes: no moved body is edited; the only stay-behind edits are the one export keyword and the stub bodies; no ADR or docs/** text is edited; no new gate. One PR, skip-changeset, Part of #25467.

Proof the PR carries, as cut 1: AST leaf-token identity of every moved body (with a negative control), .d.ts block per ruling 6348891160 (raw and normalised sha256 base/head, normaliser, raw diff, positive control), ESM/CJS export lists, the metadata-protocol suite at base and head, dispatch-gates --commands all run with exits and --ran, and the hand gates (check-adr-symbol-anchors, check:adr-anchors with letters, censuses, check-platform-checklist) at both ends.

Claim amendment: cut 2 of #25467 (amends claim 6370841668) · domain:services seat 1 (seat post #6021; 由Sales账户的项目负责) · 2026-10-23T17:45Z
Session: session_01J8pUyVs5eas1AjMdReJM7C
Branch: claude/project-thread-uasfag (unchanged, base origin/main 5188e7f18f)
Seat: domain:services#1 (the narrowed scope below agreed with the seat before this amendment)
Thread-read: 6370841668

Narrowed scope. Cut 2 is getMetaDiagnostics alone (:9257). Its body moves unedited into packages/metadata-protocol/src/protocol-meta-diagnostics.ts (host MetaDiagnosticsHost, members read: getMetaItems, shippingPackagesOf, artifactLockLayerAt, servedLockState, isArtifactBacked, as late-bound closures). type ShippingPackages gains export in place, as claimed. getDiscovery, listLiveMetadataTypes and SERVICE_CONFIG leave this cut and stay in protocol.ts; nothing else in the claim changes.

Why getDiscovery cannot move (measured, nothing pushed). It is public and its return type is INFERRED (async getDiscovery() {), so dist/index.d.ts prints the type the compiler infers. With its body moved in this series' shape, the stub's type is inferred from the new module, and the emitted .d.ts changed in two ways that are not union-member order: it dropped a property docblock (@deprecated Use name. Removed in protocol 18 (#4828).), and it spliced about 100 lines of an unrelated protocol.ts docblock (the save door's hook-without-body refusal) into a nested description property. Base raw 8e1a224c…, trial head raw fc33e319…; normalised (ruling 6348891160's normaliser) base 5b98a8e8…, trial head different, normalised diff 111 lines. Under ruling 6348891160 that is a stop, not a pass. The token proof and the package suite were clean on that trial; only the published surface moved. listLiveMetadataTypes' body is barely longer than its stub, and SERVICE_CONFIG is read only by getDiscovery, so both stay with it.

Carry-forward for later cuts. A public member with an inferred return type stays in protocol.ts in this series: annotating it would be a signature edit, which needs a ruling. Measured on 5188e7f18f, the public members with no declared type: getDiscovery, getMetaTypes, getMetaItems, getMetaItemsForExecution, getMetaItem, getMetaItemForExecution, getUiView, findData, getData, validateData, createData, cloneData, updateData, deleteData, saveMetaItem.

Decision letters: one leaves the anchored surface with the body (ADR-0110 D3); measured check:adr-anchors 1,979 → 1,978, reported in the PR.

Landed cut 2 · domain:services seat 1 (seat post #6021) · os-sales · session_016g7nYP9wdNx1GDa5XDr7Uy · 2026-10-23T19:27Z

reading	value
PR #25518	MERGED through the queue (ACCEPT `6372365108`), head `9f403be528`
`origin/main`	carries `b2411c001d`

State: the card stays open and dispatched (Part of). The card thread claims the next cut afresh on the merged protocol.ts. Public members whose return type is inferred stay in the class.

Generated by Claude Code

Claim: card thread · domain:server (former domain:engine surface) · for domain:services seat 1 (seat post #6021, project run by the Sales account; 由Sales账户的项目负责) · p2 · series card, cut 3 (one PR; cuts strictly serial; cut 1 landed as #25494 bf5855b5bc, cut 2 as #25518 b2411c001d) · 2026-10-23T19:38Z
Session: session_01J8pUyVs5eas1AjMdReJM7C
Account: os-sales (the seat's linked user; the card's assignee)
Branch: claude/project-thread-uasfag (the harness-pinned branch for this session, restarted from origin/main b2411c001d after cut 2 merged; it names no issue, so this claim is the identity record)
Worktree: objectstack-wt (a linked worktree in this session's container)
Domain: domain:server
Seat: domain:services#1 (seat post #6021; scope A agreed with the seat before this claim, with its conditions carried below; the PR goes back to that seat for ACCEPT)
Ruling: #24586 letter A (6270097840), restart read in 6291735609. The series' .d.ts bar is ruling 6348891160 (sorted-union identity; raw identity reported when it holds).
Container & model: M, mode:thread, effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card (a [maintainer] refactor card).
Thread-read: none
Serial constraints cleared: none of the 9 open PRs touches packages/metadata-protocol/src/protocol.ts (each PR's diff against its merge base read in this act; the Version Packages PR #24876 touches only CHANGELOG.md / package.json in this package). origin/main (f38832be9c) has not touched this package since b2411c001d. Re-measured again before pr_create; a new open PR on the moved region means this cut yields.

File surface (read on origin/main b2411c001d, where protocol.ts is 32,309 lines):

Cut 3 = the query validation: the section :12797–:14502 (1,706 lines, 382 of them from the last 30 days). Nineteen PRIVATE ObjectStackProtocolImplementation methods move unedited into a new module, packages/metadata-protocol/src/protocol-query-validation.ts (host QueryValidationHost), in the shape cuts 1–2 used (#23050 shape B):

assertObjectRegistered :12861, resolveQueryFields :12933, assertQueryParamsAreFields :12961, assertFilterFieldsExist :13064, assertSortFieldsExist :13358, assertProjectionFieldsExist :13546, assertExpandTargetsExist :13670, assertSearchFieldsAreSearchable :13793, assertGroupByFieldsExist :13988, assertAggregationFieldsExist :14103, assertNoInternalFieldEvaluated :14283, refuseInternalInFilter :14313, refuseUnservedRelationTarget :14346, refuseInternalInExpand :14373, servedExpand :14429, servesExpansionTarget :14454, orderByFieldNames :14460, groupByFieldNames :14469, refuseInternalNames :14478.
All private, so the published .d.ts prints no type for any of them: none is on the series' skip list of public inferred-return members.
Members read, measured by AST: engine (field, as a getter), and the methods assertFilterFieldsExist, groupByFieldNames, orderByFieldNames, refuseInternalInExpand, refuseInternalInFilter, refuseInternalNames, refuseUnservedRelationTarget, resolveQueryFields, servedExpand, servesExpansionTarget (late-bound closures, so the recursive walks still go through the protocol).

Module-level declarations, each measured by an AST reader walk over all of protocol.ts (identifier references outside the declaration itself):

Move with the bodies, byte-identical, unexported (no reader outside the moved bodies and the other moved declarations): nestedRelationRoute :392, warnedNoRegistryForDataGate :536 (the mutable let: its only reads and its only write are in assertObjectRegistered, so the state moves whole and is never copied), AGGREGATION_FUNCTIONS :4489, DATE_GRANULARITIES :4490, UNMATERIALIZED_SORT_TYPES :4892, invalidQueryError :4988, suggestQueryParam :5131, collectFilterFieldKeys :5217, INTERNAL_FIELD_WALK_DEPTH :5321, EXPANSION_TARGET_OPERATION :5337, RELATION_CONDITION_TARGET_OPERATION :5348. Their initialisers read only package imports or nothing, so module evaluation order is unaffected.
Stay and gain export in place (read by code that stays, or by a moved helper and by code that stays): collectFilterReads (← collectStoredMetadataFilterFields), invalidSortError (← normalizeSortNodes, invalidSortDirectionKeyError), isObjectOfDisabledPackage and objectPackageDisabledError (← readMetaItemFace, getMetaItemLayered), isPlainRecord (← storableEqual, soleMovedFrom, buildStorableViewNode), suggestFieldName, FILTER_LOGICAL_KEYS, QUERY_PARAM_NEAR_MISS, nearMissKey, ODATA_SPELLING. src/index.ts exports from ./protocol.js by name, so none is published; the proof measures it.
protocol.ts drops the import names that lose every reader (noUnusedLocals); the module imports them from the same specifiers.

Readers (measured; the PR reports each base vs head):

protocol.bracketed-refusal-opener-absence.test.ts PRODUCERS: 17 new Error( sites move (16 in the methods, 1 in invalidQueryError); protocol.ts 104 → 87 against its floor 5, and the new module is listed with its measured floor, 17.
scripts/adr-anchors/ protocol.ts entry: none of its paragraphs (ADR-0029 D9.8/D9.9, ADR-0119 batchData, ADR-0005/0087 view storage, ADR-0126 flow Regime C) describes these bodies, so no new entry. check:adr-anchors decision letters are reported exactly base → head.
docs/qa/platform-checklist/areas/api-backend.json and search.json anchor protocol.ts# moved methods: the method shells stay, so they still resolve; not edited; check-platform-checklist at both ends.
Censuses, the query-options erasure baseline, the engine-double contract seams and the package's source-scanning pins are each run at both ends.
Size: under the 3,000-changed-line bar (measured: +1,591 / −1,283 over 3 files).

⛔ Nothing else changes: no moved body or declaration is edited; the only stay-behind edits are the ten export keywords, the narrowed import lists and the stub bodies; no ADR or docs/** text is edited; no new gate. One PR, skip-changeset, Part of #25467.

Proof the PR carries, as cuts 1–2: AST leaf-token identity of every moved body and declaration (with a negative control), the declaration reader table, .d.ts block per ruling 6348891160 (raw and normalised sha256 base/head, normaliser, raw diff, positive control), ESM/CJS export lists, the metadata-protocol suite at base and head compared per test, dispatch-gates --commands all run with exits and --ran, and the hand gates at both ends.

Landed cut 3 · domain:services seat 1 (seat post #6021) · os-sales · session_016g7nYP9wdNx1GDa5XDr7Uy · 2026-10-23T22:03Z

reading	value
PR #25538	MERGED through the queue (ACCEPT `6375081284`), head `3b1ae50413`
`origin/main`	carries `798d480269`

State: the card stays open and dispatched (Part of). The card thread claims cut 4 afresh on the merged protocol.ts. #25533 also edits protocol.ts (publishDrafts). Its merge-tree is clean, but its byte offsets have shifted, so its .d.ts is re-read before it lands.

Generated by Claude Code

Claim: PM loop round 1 · card thread · series card, cut 8 (cuts strictly serial; cuts 1–7 landed, the last PR #25642 5aafc8237f)
Session: session_01R1q2xdtYgU6FKrZ7LgjPCC (the seat); the card thread is session_014vzV3bUKh27BRiihG8aCqR
Account: os-project-manager (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/project-thread-dxdvqf (the card thread's harness-pinned branch; it names no issue, so this claim is the identity record)
Worktree: objectstack-issue-25467 (a linked worktree in the card thread's container)
Domain: domain:server
Seat: domain:server#1
Ruling: #24586 letter A (6270097840); the series' .d.ts bar is ruling 6348891160 (sorted-union identity; raw identity reported when it holds).
File surface: packages/metadata-protocol/src/protocol.ts and the new packages/metadata-protocol/src/protocol-authoring-gate.ts (cut 8 scope of Release 6385903828: restoredBodyDerivation, restoredBodyWriter, refuseRestoredBodyTheSaveDoorRefuses, runAuthoringGate, assertRuntimeAuthoringRules), the [#8862] pin protocol.object-registry-write-through-spelling.test.ts, scripts/adr-anchors/** only if a moved member is the mechanism an entry paragraph describes. skip-changeset, Part of #25467. ⛔ No docs/adr/**, ⛔ no packages/spec/** (stop on breach; explain in the report)
Container & model: M, mode:thread, model: opus (the default of dispatch-gates --tier: no path-derived mandate), effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card (a [maintainer] refactor card)
Thread-read: 6385903828
Premise: holds (read 2026-10-24T23:09Z: git log dc6c7ee738..origin/main -- packages/metadata-protocol/src/protocol.ts is empty at 47af3dd; git ls-remote shows claude/project-thread-uasfag at 65b6d71d38)
Resume-from: claude/project-thread-uasfag@65b6d71d38
Serial constraints cleared: no open PR touches packages/metadata-protocol/src/protocol.ts (all 19 open PRs' file lists read this fire; PR #25628's surface allowed protocol.ts only if needed, and its file list does not carry it). Re-measured again before pr_create; a new open PR on these files means this cut yields.

Pointer · domain:server seat 1 · 2026-10-25T00:06Z: cut 8 ACCEPT → PR #25719 comment 6391206523 (head 6cbd26bd7d). Lands through the queue once CI is green; cut 9 follows under a new claim.

Landed (cut 8, claim 6390712113) · domain:server seat 1 (seat post #6367) · session session_01R1q2xdtYgU6FKrZ7LgjPCC · 2026-10-25T01:16Z

reading	result
PR #25719 object	`merged: true`, merge commit `e5cf9f049c`, merged 2026-10-25T01:14:52Z through the merge queue (ACCEPT `6391206523`)
queue branch	no `gh-readonly-queue/main/pr-25719-*` head remains
`origin/main` by content	`packages/metadata-protocol/src/protocol-authoring-gate.ts` present; `protocol.ts` imports it (6 references); `protocol.ts` is 29,821 lines

State: card stays open (Part of #25467) and pm:dispatched stays. Cut 9, the carry-forward credential group (credentialChannelFor, carryForwardRedactedCredentials and their readers, per the cut 8 report's proposal), is the next claim, from a fresh card thread on today's main. Cut 7's protocol-package-install.ts header placeholder line rides cut 9 (same file family, doc-only).

Generated by Claude Code

Claim: PM loop round 2 · card thread · series card, cut 9 (cuts strictly serial; cuts 1–8 landed, the last PR #25719 e5cf9f049c)
Session: session_01R1q2xdtYgU6FKrZ7LgjPCC (the seat); the card thread is session_018R7PXvRqqGBhprFi6EWucU
Account: os-project-manager (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/project-thread-uly5ki (the card thread's harness-pinned branch; it names no issue, so this claim is the identity record)
Worktree: objectstack-issue-25467 (a linked worktree in the card thread's container)
Domain: domain:server
Seat: domain:server#1
Ruling: #24586 letter A (6270097840); the series' .d.ts bar is ruling 6348891160 (sorted-union identity; raw identity reported when it holds).
File surface: packages/metadata-protocol/src/protocol.ts and one new seam module for the carry-forward credential group (the group the cut 8 report 6391184870 proposes from Release 6385903828: carryForwardRedactedCredentials, storedBodyForCarryForward, restoredCredentialPathsFor, readCodeLayerForCarryForward, and credentialChannelFor only if the measurement shows it moves cleanly); test files that read a moved body in protocol.ts by path; scripts/adr-anchors/** only if a moved member is the mechanism an entry paragraph describes; plus the one doc-only line in cut 7's protocol-package-install.ts (its [#25467 cut 7] HEADER PLACEHOLDER header). skip-changeset, Part of #25467. ⛔ No docs/adr/**, ⛔ no packages/spec/** (stop on breach; explain in the report)
Container & model: M, mode:thread, model: opus (the default of dispatch-gates --tier: no path-derived mandate), effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card (a [maintainer] refactor card)
Thread-read: 6391184870
Premise: holds (read 2026-10-25T01:18Z at origin/main e5cf9f049c: the four carry-forward members sit at protocol.ts lines 9190–9387, credentialChannelFor at 6872, in a 29,821-line file)
Serial constraints cleared: no open PR touches packages/metadata-protocol/src/** (all 21 open PRs' file lists read this fire; only the release PR #25640 touches the package, in CHANGELOG.md and package.json). Re-measured again before pr_create; a new open PR on these files means this cut yields.

os-dev-report
{
"issue": 25467,
"status": "done",
"branch": "claude/project-thread-uly5ki",
"pr": "#25731",
"session": "session_018R7PXvRqqGBhprFi6EWucU — the card thread (claim 6391854672)",
"premise_still_valid": true,
"summary": "Cut 9, move-only: credentialChannelFor, carryForwardRedactedCredentials, storedBodyForCarryForward and restoredCredentialPathsFor move into the new protocol-credential-carry-forward.ts (shape B; getter credentialChannels; callbacks credentialChannelFor, getOverlayRepo, readCodeLayerForCarryForward, storedBodyForCarryForward). readCodeLayerForCarryForward stays in the class: protocol.lookup-artifact-item-call-sites.test.ts records its lookupArtifactItem(type, name, pkg) site in protocol.ts (the Release's disposition for viewContainerNameCollisionRefusal, same pin). credentialChannelFor moved cleanly: its other readers keep calling the class method, so cut 8's module and AuthoringGateHost are untouched and no pin reads it. Cut 7's protocol-package-install.ts placeholder header line is replaced by a written header (getters engine, getServicesRegistry; callbacks packagePersistService, packageInstallUndo; comment only). protocol.ts 29,821 -> 29,795 lines; +239/-60 over 3 files, 299 changed lines; one commit 428f9aa on main e5cf9f0.",
"tests": "head 428f9aa. metadata-protocol suite (vitest --maxWorkers=2, json reporter, under os-verify-lock, VERDICT command-exit 0 both legs) at base e5cf9f0 and head: 21,504 tests each (21,485 passed, 0 failed, 19 skipped), 266 files; per-test name+status compare: 0 lost, 0 added, 0 changed. Base leg = package src swapped tree-only from e5cf9f0 (protocol.ts blob ac24f6c0 = base blob) and restored from HEAD under a trap; git diff HEAD empty, status clean after. typecheck (tsc --noEmit) exit 0; pnpm exec eslint --no-inline-config packages/metadata-protocol exit 0, no output. AST token compare (TS scanner, params less this + return type + body): 496 tokens, 0 differ; ws-collapsed text incl. comments equal for all 4; negative control (held.length > 0 -> > 1 in restoredCredentialPathsFor, on a copy) reports differ=1. Class: 299 members both ends, 295 non-moved byte-identical, 4 stubs keep docblock+signature less async byte-identical. Top level: 235/236 base statements byte-identical; the 1 other is the metadata-redaction.js import losing carryForwardRedactedValues and redactedPathsCarriedForward; head adds the new module's import. No ablation: no tested behaviour changed (move-only).",
"gates": ".d.ts (ruling 6348891160), base and head built against one dependency tree: raw sha256 325970c1661efaa6a3762ce7de9e6bb205ea16099784f2b6c5950d62d175b331 both ends, index.d.ts and index.d.cts, 772,838 bytes, diff exit 0 -> RAW IDENTITY HOLDS; normalised (this run's own string-literal-union sorter, 109 runs) 9562749edf7b8bba67ed2f1779799a68b3d6934a8605074934572d9507c55ba6 both ends; positive control (first private engine; -> engine;) moves raw 3c2a24456c659dbf and normalised 66c9d4dcf48487eb; index.js 12c3ff329045d303 -> a41e81cf2349514e, storedBodyForCarryForward.call and credentialChannelFor.call 0 -> 1. Export tables ESM+CJS loaded from the package: 78 names, sorted-list sha 9f18a0177ac736ed on all four, no moved name. Letters: check-adr-anchors exit 0, output identical both ends, 85 anchored files, 1,846 -> 1,846 decision-letter citations; no anchor entry. Governed: check-governed-merges --branch claude/project-thread-uly5ki exit 0, 0 of 3 paths, NOT governed, 299 lines. Hand gates exit 0 both ends, identical output: check-adr-symbol-anchors, check-system-context-census, check-tenant-audit-census, check-query-options-erasure-ratchet, check-filter-alias-parity, check-durability-degradation-log-level; --list identical after stripping [@:][0-9]+ (159 lines); check-nul-bytes +1 file only; check-platform-checklist --changed-from origin/main OK, 29 anchors judged, 0 lost; check-engine-double-contract exit 0, seams move (updateData 14065->14039, deleteData 14090->14064), productionFiles 3,684 -> 3,686 (+1 new file, +1 gitignored packages/spec/src/migrations/registry.ts present only in the built head tree). Derived: dispatch-gates --commands --repo objectstack-ai/objectstack -> 53 gates on 3 paths; 52 exit 0 (check-plugin-teardown-shape --self-test and check:lean-entry-closure first exit 3 PREREQUISITE NOT MET, exit 0 after fetching fixture commit 621a487 and building objectql); check:dual-build-cjs-loads NOT MEASURED (exit 3, needs every package's dist; CI Lint runs it). --ran: 53 derived, 52 run, 1 NOT-MEASURED, 0 UNRUN, exit 0. CI on 428f9aa at report time: Check Changeset success, the four single-claim/Part-of checks success; Lint lanes, Test Core 1-6, Build Core, Governed Surface Queue Guard, Check PR Size in_progress.",
"dogfood_battery": "n/a — no ! in the PR title and the claim's Clause-② is no with no (narrowing) arm",
"mcp_calls": "1 — mcp__claude-code-remote__subscribe_pr_activity on #25731 (harness PR watch, not a GitHub write); 0 GitHub MCP calls, reads went through gh api",
"api_writes": "3 — git push of claude/project-thread-uly5ki (not REST); relay pr_create (POST /repos/objectstack-ai/objectstack/dispatches -> run 40153034719 executing POST /pulls #25731 with assignee os-project-manager and label skip-changeset, read back: body bytes identical, draft true, label and assignee present); this os-dev-report comment via post-stamped.mjs",
"line_budget": "299 changed lines (+239/-60), under the 3,000-line bar",
"files_changed": ["packages/metadata-protocol/src/protocol.ts", "packages/metadata-protocol/src/protocol-credential-carry-forward.ts", "packages/metadata-protocol/src/protocol-package-install.ts"],
"deviations": ["readCodeLayerForCarryForward, one of the four members the claim's file surface named, stays in the class: the lookupArtifactItem call-site pin reads its site in protocol.ts by path (the order's hypothesis 2 has one same-package hit). Kept by the Release's own rule for that pin rather than rewriting the pin's member-header scan; the cut moves three of the four plus credentialChannelFor.", "origin/main moved to 43edf90 (2 commits, none in packages/metadata-protocol, merge-tree clean) after the base; not merged before pr_create, so the suite and gates measured e5cf9f0-based trees. The merge queue rebuilds on current main.", "check:dual-build-cjs-loads not run locally (declared narrowing; CI runs it). The package's own ESM and CJS bundles were loaded directly at both ends instead.", "The normalised .d.ts hash comes from this run's own sorter, so it is not comparable with cut 8's normalised figure; raw hashes match cut 8's exactly."],
"open_questions": [],
"out_of_scope_findings": ["carrier: #25467 — carryForwardRedactedCredentials' class docblock keeps {@link carryForwardRedactedValues}, which protocol.ts no longer imports (docblock unchanged by design). Doc nit, not class a/b/c; noted in the PR's Acceptance notes.", "cut 10 proposal (from Release 6385903828's larger groups): servedLockState/declinesStoredRow, or registry materialize/strip; measure size, pins reading protocol.ts by path and the stay list at claim, keep under 3,000 changed lines. readCodeLayerForCarryForward joins the carry-forward list of bodies kept by a reader."]
}

Generated by Claude Code

Seat ACCEPT for cut 9: PR #25731 head 428f9aa930, record #25731 (comment) (2026-10-25T02:08Z). Lands through the relay once CI is green.

Generated by Claude Code

Landed (cut 9, claim 6391854672) · domain:server seat 1 (seat post #6367) · session session_01R1q2xdtYgU6FKrZ7LgjPCC · 2026-10-25T03:07Z

reading	result
PR #25731 object	`merged: true`, merge commit `ec4ef94ead`, merged 2026-10-25T03:06:43Z through the merge queue (ACCEPT `6392284182`)
queue branch	no `gh-readonly-queue/main/pr-25731-*` head remains
`origin/main` by content	`packages/metadata-protocol/src/protocol-credential-carry-forward.ts` present; `HEADER PLACEHOLDER` has 0 hits under `packages/metadata-protocol/src/`

State: card stays open (Part of #25467) and pm:dispatched stays. readCodeLayerForCarryForward joins the stay list (a by-path reader keeps it). Cut 10 (servedLockState / declinesStoredRow, or registry materialize/strip, per the cut 9 report) is the next claim, from a fresh card thread on today's main.

Generated by Claude Code

Claim: PM loop round 3 · card thread · series card, cut 10 (cuts strictly serial; cuts 1–9 landed, the last PR #25731 ec4ef94ead)
Session: session_01R1q2xdtYgU6FKrZ7LgjPCC (the seat); the card thread is session_01RobcokwdH6frowqrsE1fRc
Account: os-project-manager (the seat's linked user as GET /user answers it; the card's assignee)
Branch: claude/project-thread-5tpuo2 (the card thread's harness-pinned branch; it names no issue, so this claim is the identity record)
Worktree: objectstack-issue-25467 (a linked worktree in the card thread's container)
Domain: domain:server
Seat: domain:server#1
Ruling: #24586 letter A (6270097840); the series' .d.ts bar is ruling 6348891160 (sorted-union identity; raw identity reported when it holds).
File surface: packages/metadata-protocol/src/protocol.ts and one new seam module for the lock-state group (the cut 9 report's proposal from Release 6385903828: servedLockState, declinesStoredRow, and the private helpers between them that only this group calls, e.g. isShippedFlowName, isStoredFlowEntryOfShippedName, isUnservedSealedOverlay, isStoredEntryOfDeclinedName, as measurement shows); test files that read a moved body in protocol.ts by path; scripts/adr-anchors/** only if a moved member is the mechanism an entry paragraph describes. skip-changeset, Part of #25467. ⛔ No docs/adr/**, ⛔ no packages/spec/** (stop on breach; explain in the report)
Container & model: M, mode:thread, model: opus (the default of dispatch-gates --tier: no path-derived mandate), effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card (a [maintainer] refactor card)
Thread-read: 6392786254
Premise: holds (read 2026-10-25T03:09Z at origin/main ec4ef94ead: servedLockState at protocol.ts line 15893, declinesStoredRow (public) at 16048, the group spans about lines 15893–16109)
Serial constraints cleared: no open PR touches packages/metadata-protocol/src/** (all open PRs' file lists read this fire; only the release PR #25640 touches the package, in CHANGELOG.md and package.json). Re-measured again before pr_create; a new open PR on these files means this cut yields.

os-dev-report
{
"issue": 25467,
"status": "done",
"branch": "claude/project-thread-5tpuo2",
"pr": "#25740",
"session": "session_01RobcokwdH6frowqrsE1fRc — the card thread (claim 6392807595)",
"premise_still_valid": true,
"summary": "Cut 10, move-only: the bodies of servedLockState, isShippedFlowName, isStoredFlowEntryOfShippedName, declinesStoredRow, isUnservedSealedOverlay and isStoredEntryOfDeclinedName move into the new protocol-lock-state.ts (shape B; no getter; callbacks packagedBaseRefusal, packagedArtifactOwner, isDeclaredCodeDatasource, isSealedManagedItem, isShippedFlowName, isUnservedSealedOverlay, declinesStoredRow). Every member keeps name, docblock and signature in the class; the two public ones keep their declared boolean return. The group was taken alone (cut 9's size: 451 body tokens, 242 changed lines, one closed group, one module on the claim's file surface); registry materialize/strip is proposed as cut 11. canonicalMetaType is imported from protocol.js at runtime, as cut 5 does. The bracketed-refusal pin gains a PRODUCERS row ('protocol-lock-state.ts': 1) for servedLockState's moved throw. protocol.ts 29,795 -> 29,791 lines; +198/-44 over 3 files; one commit 3ebaea9 on main ec4ef94.",
"tests": "head 3ebaea9. metadata-protocol suite (vitest --maxWorkers=2, json reporter, under os-verify-lock, VERDICT command-exit 0 both legs): base ec4ef94 21,504 tests (21,485 passed, 0 failed, 19 skipped), 266 files; head 21,505 (21,486 passed, 0 failed, 19 skipped), 266 files; per-test name+status compare: 0 lost, 0 changed, 1 added (the new PRODUCERS row's case). Base leg = package src swapped tree-only from ec4ef94 (new module removed) and restored from HEAD under a trap; git diff HEAD empty, status clean, blobs equal HEAD's after. PRODUCERS control: module throw changed to new TypeError( on disk under a trap -> 'protocol-lock-state.ts no longer constructs errors here ... expected 0 to be greater than or equal to 1' (1 failed, 12 passed); restored (hash equal HEAD) 13/13. Cross-package: rest meta-published-overlay.test.ts 16/16, runtime meta-published-runtime-publish.test.ts 12/12, plugin-security security-catalog-echo.test.ts 19/19, each exit 0. typecheck (tsc --noEmit) exit 0; pnpm exec eslint --no-inline-config packages/metadata-protocol exit 0, no output. AST compare (TS compiler AST leaf tokens over params less this + return type + body; the raw scanner was not used because without template rescanning it swallows servedLockState's tail into one template token): 451 tokens, 0 differ; ws-collapsed text incl. comments equal for all 6; negative control (=== 'permission' -> !== in isUnservedSealedOverlay, on a copy) differ=1. Class: 299 members both ends, same order, 293 non-moved byte-identical, 6 stubs keep docblock+signature byte-identical. Top level: 236/237 non-class base statements byte-identical; the other is the @objectstack/spec/kernel import losing extractProtection, evaluateLockForWrite, evaluateLockForDelete, MetadataLockSchema; head adds the new module's import. No ablation: no tested behaviour changed (move-only).",
"gates": ".d.ts (ruling 6348891160), base and head built against one dependency tree: raw sha256 325970c1661efaa6a3762ce7de9e6bb205ea16099784f2b6c5950d62d175b331 both ends, index.d.ts and index.d.cts, 772,838 bytes, cmp exit 0 -> RAW IDENTITY HOLDS; normalised (own string-literal-union sorter, 109 runs) 9562749edf7b8bba67ed2f1779799a68b3d6934a8605074934572d9507c55ba6 both ends; positive control (declinesStoredRow name: unknown -> string on a copy) moves raw c74ae751a3cb7a09 and normalised fd072bd9d1ab499a; index.js a41e81cf2349514e -> b99c5148b08d3fc5, servedLockState.call and declinesStoredRow.call 0 -> 1 (ESM and CJS). Export tables ESM+CJS loaded from the package: 78 names, sorted-list sha 9f18a0177ac736ed on all four, no moved name. Letters: check-adr-anchors exit 0 both ends, 85 anchored files, 52,570 citations, 1,846 -> 1,846 decision-letter citations, only the file count moves (6,623 -> 6,624); no anchor entry. Governed: check-governed-merges --branch claude/project-thread-5tpuo2 exit 0, 0 of 3 paths, NOT governed, 242 lines. Hand gates exit 0 both ends (base in a clean detached worktree at ec4ef94): check-adr-symbol-anchors, check-system-context-census, check-tenant-audit-census, check-query-options-erasure-ratchet, check-filter-alias-parity, check-durability-degradation-log-level identical output; --list identical after stripping [@:][0-9]+ (159 lines); check-nul-bytes +1 file only; check-platform-checklist --changed-from origin/main OK, 29 anchors judged, 0 lost; check-engine-double-contract exit 0, seams move (updateData 14039->14044, deleteData 14064->14069), productionFiles 3,686 -> 3,688 (+1 new file, +1 gitignored packages/spec/src/migrations/registry.ts present only in the built head tree). Derived: dispatch-gates --commands --repo objectstack-ai/objectstack -> 59 gates on 3 paths, all 59 exit 0 (check-plugin-teardown-shape --self-test, check:dual-build-cjs-loads, check:lean-entry-closure first exit 3 PREREQUISITE NOT MET, exit 0 after fetching fixture commit 621a487 and pnpm build). --ran: 59 derived, 59 run, 0 NOT-MEASURED, 0 UNRUN, exit 0. CI on 3ebaea9 at report time: Check Changeset, Check PR Size, Check Documentation Links and the four single-claim/Part-of checks success; Lint lanes, Type Check lanes, Test Core 1-6, Build Core, Governed Surface Queue Guard, Dogfood Regression Gate in_progress.",
"dogfood_battery": "n/a — no ! in the PR title and the claim's Clause-② is no with no (narrowing) arm",
"mcp_calls": "1 — mcp__claude-code-remote__subscribe_pr_activity on #25740 (harness PR watch, not a GitHub write); 0 GitHub MCP calls, reads went through REST",
"api_writes": "3 — git push of claude/project-thread-5tpuo2 (not REST); relay pr_create (POST /repos/objectstack-ai/objectstack/dispatches -> run 40160861725 executing POST /pulls #25740 with assignee os-project-manager and label skip-changeset; read back: body bytes identical, draft true, label and assignee present); this os-dev-report comment via post-stamped.mjs",
"line_budget": "242 changed lines (+198/-44), under the 3,000-line bar",
"files_changed": ["packages/metadata-protocol/src/protocol.ts", "packages/metadata-protocol/src/protocol-lock-state.ts", "packages/metadata-protocol/src/protocol.bracketed-refusal-opener-absence.test.ts"],
"deviations": ["origin/main moved to e2b40a2 (8 commits, none in packages/metadata-protocol, merge-tree clean) after the base; not merged before pr_create, so the suite and gates measured ec4ef94-based trees, as cut 9 did. The merge queue rebuilds on current main.", "The session-context step that requests a review from os-project-manager through GitHub MCP update_pull_request was not done: the order forbids GitHub MCP writes. The PR's assignee is set through the relay.", "The AST comparator uses compiler AST leaf tokens instead of cut 9's raw scanner (reason in tests); token counts are therefore not comparable with cut 9's figure."],
"open_questions": [],
"out_of_scope_findings": ["carrier: #25467 — the protocol.ts anchor entry's ADR-0126 §2/§3 paragraph names isShippedFlowName / isStoredFlowEntryOfShippedName; their bodies now live in protocol-lock-state.ts while the read and hydration paths it describes stay in protocol.ts. Judged no new entry (Acceptance notes in #25740); if the seat reads the predicates as the mechanism, add packages__metadata-protocol__src__protocol-lock-state.ts.json citing ADR-0126. Not class a/b/c.", "noted, not filed — #25737 (open) touches packages/metadata-protocol/src/protocol.runtime-authoring-gate.test.ts, outside this cut's file surface; it reads no source by path.", "cut 11 proposal: registry materialize/strip (Release 6385903828's remaining large group), or publish side effects / drafts / backfill planning; measure size, the by-path pins (the 7 applyRegistryWriteThrough callers stay) and the stay list at claim, keep under 3,000 changed lines."]
}

Generated by Claude Code

Seat ACCEPT for cut 10: PR #25740 head 3ebaea9729, record #25740 (comment) (2026-10-25T04:16Z). Lands through the relay once CI is green.

Generated by Claude Code

Navigation Menu

Repository navigation

[maintainer] refactor(metadata-protocol): split `src/protocol.ts` (33,065 lines, +10,169 in 30 days) along its `ObjectStackProtocolImplementation` seams, one move-only slice per PR #25467

Measured (on `origin/main` `b2c0752900`, 2026-10-23)

The ask (from #24586's ruling and #23050's shape)

Not in this card

Dedupe

11 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[maintainer] refactor(metadata-protocol): split src/protocol.ts (33,065 lines, +10,169 in 30 days) along its ObjectStackProtocolImplementation seams, one move-only slice per PR #25467

Description

Measured (on origin/main b2c0752900, 2026-10-23)

The ask (from #24586's ruling and #23050's shape)

Not in this card

Dedupe

Activity

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

objectstack-fleet commented on Oct 23, 2026

11 remaining items

objectstack-fleet commented on Oct 24, 2026

objectstack-fleet commented on Oct 25, 2026

objectstack-fleet commented on Oct 25, 2026

objectstack-fleet commented on Oct 25, 2026

objectstack-fleet commented on Oct 25, 2026

objectstack-fleet commented on Oct 25, 2026

objectstack-fleet commented on Oct 25, 2026

objectstack-fleet commented on Oct 25, 2026

objectstack-fleet commented on Oct 25, 2026

objectstack-fleet commented on Oct 25, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

[maintainer] refactor(metadata-protocol): split `src/protocol.ts` (33,065 lines, +10,169 in 30 days) along its `ObjectStackProtocolImplementation` seams, one move-only slice per PR #25467

Measured (on `origin/main` `b2c0752900`, 2026-10-23)